conducting-cloud-incident-response

name	conducting-cloud-incident-response
description	Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Use when CSPM alerts or audit logs show compromised cloud credentials, unauthorized IAM changes, or a breach spanning cloud services.
domain	cybersecurity
subdomain	incident-response
tags	["cloud-IR","AWS-forensics","Azure-incident-response","GCP-security","identity-containment"]
mitre_attack	["T1078","T1537","T1580","T1525"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Conducting Cloud Incident Response

When to Use

• Cloud security posture management (CSPM) alerts on unauthorized resource changes
• CloudTrail, Azure Activity Logs, or GCP Audit Logs show suspicious API calls
• Cloud access keys or service principal credentials are suspected compromised
• Unauthorized compute instances, storage buckets, or IAM changes are detected
• A cloud-hosted application is breached and attacker activity spans cloud services

Do not use for on-premises-only incidents with no cloud component; use standard enterprise IR procedures.

Prerequisites

• Cloud-native logging enabled and centralized: AWS CloudTrail (all regions), Azure Activity/Sign-in Logs, GCP Cloud Audit Logs
• IR-specific cloud IAM roles pre-provisioned with read-only forensic access
• Isolated forensic account/subscription/project for evidence preservation
• Cloud incident response runbooks specific to each cloud provider
• Cloud-native security tools: AWS GuardDuty, Azure Defender for Cloud, GCP Security Command Center
• Network traffic logging: VPC Flow Logs (AWS/GCP), NSG Flow Logs (Azure)

Workflow

Step 1: Detect and Confirm the Cloud Incident

Identify the scope and nature of the compromise:

AWS Indicators:

CloudTrail suspicious events to investigate:
- ConsoleLogin from unexpected geolocation or IP
- CreateAccessKey for existing IAM user (persistence)
- RunInstances for crypto-mining (large instance types)
- PutBucketPolicy making S3 bucket public
- AssumeRole to cross-account roles
- DeleteTrail or StopLogging (defense evasion)
- CreateUser or AttachUserPolicy (privilege escalation)

Azure Indicators:

Azure Activity Log events to investigate:
- Sign-in from anonymous IP or TOR exit node
- Service principal credential added
- Role assignment changes (Owner, Contributor added)
- VM created in unusual region
- Storage account access key regenerated
- Conditional Access policy modified or deleted
- MFA disabled for user account

GCP Indicators:

GCP Audit Log events to investigate:
- SetIamPolicy changes granting broad access
- CreateServiceAccountKey for existing SA
- InsertInstance in unexpected zone
- SetBucketIamPolicy with allUsers
- DeleteLog or UpdateSink (log tampering)

Step 2: Contain Cloud Identity Compromise

Cloud containment is primarily an identity operation:

AWS Containment:

# Disable compromised IAM access keys
aws iam update-access-key --user-name compromised-user \
  --access-key-id AKIA... --status Inactive


aws iam attach-user-policy --user-name compromised-user \
  --policy-arn arn:aws:iam::aws:policy/AWSDenyAll


aws iam put-role-policy --role-name compromised-role \
  --policy-name RevokeOlderSessions --policy-document 


aws ec2 modify-instance-attribute --instance-id i-0abc123 \
  -- sg-isolate-forensic